Commit 195b9cb5 authored Jul 07, 2023 by Masami Hiramatsu (Google)

fprobe: Ensure running fprobe_exit_handler() finished before calling rethook_free()

Ensure running fprobe_exit_handler() has finished before
calling rethook_free() in the unregister_fprobe() so that caller can free
the fprobe right after unregister_fprobe().

unregister_fprobe() ensured that all running fprobe_entry/exit_handler()
have finished by calling unregister_ftrace_function() which synchronizes
RCU. But commit 5f810187 ("fprobe: Release rethook after the ftrace_ops
is unregistered") changed to call rethook_free() after
unregister_ftrace_function(). So call rethook_stop() to make rethook
disabled before unregister_ftrace_function() and ensure it again.

Here is the possible code flow that can call the exit handler after
unregister_fprobe().

------
 CPU1                              CPU2
 call unregister_fprobe(fp)
 ...
                                   __fprobe_handler()
                                   rethook_hook() on probed function
 unregister_ftrace_function()
                                   return from probed function
                                   rethook hooks
                                   find rh->handler == fprobe_exit_handler
                                   call fprobe_exit_handler()
 rethook_free():
   set rh->handler = NULL;
 return from unreigster_fprobe;
                                   call fp->exit_handler() <- (*)
------

(*) At this point, the exit handler is called after returning from
unregister_fprobe().

This fixes it as following;
------
 CPU1                              CPU2
 call unregister_fprobe()
 ...
 rethook_stop():
   set rh->handler = NULL;
                                   __fprobe_handler()
                                   rethook_hook() on probed function
 unregister_ftrace_function()
                                   return from probed function
                                   rethook hooks
                                   find rh->handler == NULL
                                   return from rethook
 rethook_free()
 return from unreigster_fprobe;
------

Link: https://lore.kernel.org/all/168873859949.156157.13039240432299335849.stgit@devnote2/



Fixes: 5f810187 ("fprobe: Release rethook after the ftrace_ops is unregistered")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>

parent ed9492df

include/linux/rethook.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -59,6 +59,7 @@ struct rethook_node {
		};

		struct rethook rethook_alloc(void data, rethook_handler_t handler);
		void rethook_stop(struct rethook *rh);
		void rethook_free(struct rethook *rh);
		void rethook_add_node(struct rethook rh, struct rethook_node node);
		struct rethook_node rethook_try_get(struct rethook rh);

kernel/trace/fprobe.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -366,6 +366,9 @@ int unregister_fprobe(struct fprobe *fp)
		fp->ops.saved_func != fprobe_kprobe_handler))
		return -EINVAL;

		if (fp->rethook)
		rethook_stop(fp->rethook);

		ret = unregister_ftrace_function(&fp->ops);
		if (ret < 0)
		return ret;

kernel/trace/rethook.c

+13 −0

Original line number	Diff line number	Diff line
		@@ -53,6 +53,19 @@ static void rethook_free_rcu(struct rcu_head *head)
		kfree(rh);
		}

		/**
		* rethook_stop() - Stop using a rethook.
		* @rh: the struct rethook to stop.
		*
		* Stop using a rethook to prepare for freeing it. If you want to wait for
		* all running rethook handler before calling rethook_free(), you need to
		* call this first and wait RCU, and call rethook_free().
		*/
		void rethook_stop(struct rethook *rh)
		{
		WRITE_ONCE(rh->handler, NULL);
		}

		/**
		* rethook_free() - Free struct rethook.
		* @rh: the struct rethook to be freed.